When consent is not an appropriate legal basis for transferring personal data from the European Union to third countries, which are not on the EU's short list of “adequate” countries, contracts have been a much simpler way forward because consent is often difficult to obtain and may be withdrawn. Binding Corporate Rules are limited in scope, expensive and time consuming. But the three original Standard Contractual Clauses (SCCs) had become increasingly out of date, as they did not reflect the current multi-party reality of organisations processing personal data, often with the help of cloud services (pp. 20 and 25) and a mass of sub-processors.